Privacy Policy

Last updated: July 24, 2026

1. What we collect

Account

• Email address and, if you signed up with a password, a securely hashed password.
• If you signed in with Google or X, the basic profile information that provider returns (name, avatar, handle). We receive this once at sign-in; we get no ongoing access to the account.

Your public page

• Handle, display name, bio, avatar, cover image, location and social links.
• Products you add: name, pitch, URL, status, revenue figures, tech stack.
• Any content blocks you create.

This is published at shipped.so/@yourhandle and is visible to anyone. Only add what you want public.

Circle application

• Your X handle (as text — we do not connect to the account).
• Your niche, product, product description and target customer.
• Your preferred language and timezone.
• Your stage, and any notes you choose to add.

We use this to verify you and to match you sensibly. It is read by a human reviewer.

Circle activity

• Posts and replies you write in your circle room, and any links you share there.
• Which circle you are in, and when you joined or left.
• Reports you file, and reports filed about you.

Circle content is visible to the other members of that circle and to Shipped moderators. It is not public and is not indexed by search engines.

Analytics on your page

• Page views and clicks on your public page, with approximate country, referrer and user agent.
• These are shown to you in your dashboard. We do not use third-party advertising or cross-site tracking.

2. Payments

Founder Circles memberships are processed by Dodo Payments, who act as merchant of record. When you check out, you are on their payment page and your card details go to them, never to us.

We store only what we need to know whether your membership is active:

• Membership status, plan, amount, currency, start and renewal dates.
• The subscription identifier Dodo gives us, so we can look the subscription up.

Dodo handles invoicing and applicable tax and processes your billing details under their own privacy policy.

3. How we use your information

• To run your account and publish your page.
• To verify applicants and match them into circles.
• To operate circle rooms and moderate them.
• To take payment and manage renewals.
• To send you transactional email: welcome, weekly circle digest, notifications you opted into.
• To investigate reports, abuse and breaches of our Terms.

Legal bases (UK/EU): performance of a contract for account, membership and circle features; legitimate interests for security, moderation and product analytics; consent for optional marketing email, which you can withdraw at any time.

4. Who we share it with

We use a small number of processors, each doing one job:

• Supabase — database, authentication and file storage.
• Netlify — hosting and delivery.
• Resend — sending transactional email.
• Dodo Payments — payments, invoicing and tax as merchant of record.
• Google (Gemini) — only if you use the optional link import or mindmap features, which send the relevant content for processing at that moment.

We may also disclose information where legally required, or to protect the rights and safety of members. We do not sell personal data, and we do not share it with advertisers.

5. AI and model training

We do not use your content to train AI models, and we do not license it to anyone else for that purpose. The optional import and mindmap features send content to Google's API to generate a result for you at that moment; we do not use them to build a dataset.

6. Cookies

We use cookies that are strictly necessary to keep you signed in, plus local storage for your theme preference. We do not use advertising or cross-site tracking cookies.

7. Your rights

• Access and portability — ask for a copy of your data.
• Correction — edit your profile, products and application at any time.
• Deletion — delete your account from Settings. This removes your profile, products, blocks, analytics, application and circle posts.
• Objection and restriction — ask us to stop or limit a particular use.
• Withdraw consent — unsubscribe from optional email from your notification settings.
• Complain — if you are in the UK or EU you may complain to your local data protection authority.

8. Retention

• Account and page data: kept while your account exists.
• On deletion: removed promptly, with backups cycling out within 30 days. Circle posts are removed; replies you wrote on someone else's post may remain in anonymised form so the conversation still reads.
• Analytics: retained for up to 24 months.
• Payment and invoice records: retained by Dodo Payments as long as tax and accounting law requires.
• Moderation records: retained while needed to keep circles safe.

9. Security

• All traffic is served over HTTPS.
• Passwords are hashed by Supabase Auth; we never see them.
• Row-level security is enforced in the database, so one member cannot read another circle's room.
• Access to production data is limited to those who need it.

No system is perfectly secure. If you find a vulnerability, please tell us at security@shipped.so before disclosing it publicly.

10. Children

Shipped is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

11. International transfers

Shipped is available worldwide and our processors operate in several regions, including the EU and the United States. Where data leaves the UK or EEA, it is transferred under appropriate safeguards such as standard contractual clauses.

12. Changes to this policy

We may update this policy. If a change is material we will notify members by email before it takes effect. The date at the top always reflects the current version.

13. Contact

• Privacy: privacy@shipped.so
• Security: security@shipped.so
• X: @azagsam